diff --git a/rules/apt/apt_turla_service_png.yml b/rules/apt/apt_turla_service_png.yml
index 0a6735f21..2c95c6cd8 100644
--- a/rules/apt/apt_turla_service_png.yml
+++ b/rules/apt/apt_turla_service_png.yml
@@ -5,9 +5,9 @@ references:
 author: Florian Roth
 date: 2018/11/23
 tags:
-    - attack.command_and_control
-    - attack.g0016
-    - attack.t1172
+    - attack.persistence
+    - attack.g0010
+    - attack.t1050
 logsource:
     product: windows
     service: system